Two environments, each with a standard host and a secure host.
| Environment | Base URL |
|---|---|
| Sandbox | https://sandbox-api.spinwheel.io |
| Production | https://api.spinwheel.io |
| Sandbox — secure | https://secure-sandbox-api.spinwheel.io |
| Production — secure | https://secure-api.spinwheel.io |
Every path is prefixed /v1. Keys are environment-specific, so the base URL and the key have to travel together.
Sandbox
Same endpoints, request bodies and response shapes as production, and the only environment with self-serve keys.
Sandbox does not call the real bureaus. Credit reports, scores and liability data come from a fixed set of sandbox test users, so use those identities rather than arbitrary personal details.
Sandbox also has helpers production lacks, including simulating payment transaction flows.
Production
Every pull is a real inquiry on a real credit file. Two consequences:
- Capture consent and display the Spinwheel End User Agreement before connecting a user or pulling a profile.
- Rate limits apply in full — one Debt Profile per user per day in particular.
Production access comes from your Spinwheel representative.
Secure endpoints
Endpoints that take full SSNs, KBA answers or raw identity attributes are served only from the secure- hosts. Same /v1 prefix, same key, same response envelope — only the transport path differs.
An endpoint that requires the secure host is rejected on the standard host even with a valid key, and its reference page says so. Connect a User via KBA is the one most integrations hit first. Everything else should use the standard host.
How to Go Live
- Get a production key from your Spinwheel representative.
- Switch the base URL and the key together.
- Re-test your failure paths.